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"Cryptojacking" is nothing new but it has begun to pick up more steam in recent months. For 
the unaware, cryptojacking typically involves unscrupulous website owners or advertisers 
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using JavaScript code to take advantage of a website visitor's CPU power to mine 
cryptocurrency in the background, without their knowledge or consent. 

The Pirate Bay was one of the first websites of note to contain this sort of code but its use 
has only become more common over time. Indeed, the problem has become so pervasive in 
certain parts of the internet that web browsers such as Opera have received new features 
specifically designed to mitigate or eliminate these issues -- usually in the form of ad blocking 
filters. 

While simply avoiding sketchy sites to begin with might seem like the obvious solution, the 
issue becomes more complicated when this code starts to appear on bigger, more well- 
known sites like Showtime or even YouTube. 

This past week YouTuber viewers' antivirus programs began to alert them to the presence of 
cryptocurrency mining code throughout the website this week, specifically within YouTube's 
advertising code. Naturally, this led to some users hopping on Twitter to voice their concerns. 


Diego Betto 

@diegobetto 


Hey @avast_antivirus seems that you are blocking crypto 
miners (#coinhive) in @YouTube #ads 
Thank you :)diegobetto.com/crypto-miner-c... 

11:40 PM-Jan 25, 2018 


Crypto Miner (Coinhive) in YouTube Ads | Diego Betto 

During normal browsing on YouTube, at some point, the antivirus 
Avast reported something that was not good. From the Chrome 
diegobetto.com 

106 104 people are talking about this 
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Great now my browser everytime I watch youtube... my anti virus always blocking 
coinhive because malware . Idk much about it but this is getting annoying and I need a 
solution please T n T 

— Arung (@ArungLaksmana) January 23, 2018 

Researchers from antivirus company Trend Micro said these ads resulted in "more than a 
three-fold spike" in web miner detection stats. The company also said the individuals behind 
the ads seemed to be targeting YouTube visitors in specific countries, such as France, 
Taiwan, Italy, Spain and Japan. 

"YouTube was likely targeted because users are typically on the site for an extended period 
of time," security researcher Troy Mursch said in a statement. "This is a prime target for 
cryptojacking malware, because the longer the users are mining for cryptocurrency the more 
money is made." 

This may not seem like a significant issue but background miners can hog quite a bit of a 
given system's computing power if left unchecked, as much as 80 percent according to 
Trend Micro. 

Google issued the following statement on the matter: 

Mining cryptocurrency through ads is a relatively new form of abuse that violates our 
policies and one that we’ve been monitoring actively. We enforce our policies through a 
multi-layered detection system across our platforms which we update as new threats 
emerge. In this case, the ads were blocked in less than two hours and the malicious 
actors were quickly removed from our platforms. 

As Ars noted, evidence supplied by Trend Micro seems to contradict Google's statement. 
The antivirus company has shown several examples of these ads being in place for the 
better part of a week, which is certainly longer than the two hours Google claims it took to 
shut the scheme down. 

Permalink to story. 

https://www.techspot.com/news/72973-drive-cryptomining-code-discovered-youtubes-ad-system- 

week.html 
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I demand YouTube send me another 1080ti for this gross negligence 
in advertising security. 
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davislanel said: \ 

I demand YouTube send me another 1080ti for this gross negligence in advertising 
security. 

They probably can't afford the $1500 it would cost to buy one. 

Reehahs and davislanel like this. 

Jan 27, 2018 #3 


Polycount said: \ 

They probably can't afford the $1500 it would cost to buy one. 

davislanel All they have to do is demand content creators with more than 2 fork 

ts Grand inquisitor one over or f ace f ur ther demonetization. They'll comply. 

Posts: 4,829 +3,840 ^ 
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I don't leave my computer running long enough to help them use it. 
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Jan 27, 2018 #5 

I'm running an Intel G-41 board with the stock IGP. I'm wondering how 
much mining could this rig accomplish? 


Last edited: Jan 27, 2018 
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Ads have no benefit to anyone and they seem to be harmful as well. 
Maybe it's time to ban all ads. Or at least make them text based and 
limited to 20 letters; product name and what it does. And make lying 
illegal, that would fix most problems. You can use science to prove 
stuff if not your product is based on a lie. 
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davislanel said: f 
Polycount said: f 

They probably can't afford the $1500 it would cost to buy one. 

All they have to do is demand content creators with more than 2 fork one over or face 
further demonetization. They'll comply. 
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And by "content creators" you mean miners. 

Jan 28,2018 #8 

davislanel said: t 

I demand YouTube send me another 1080ti for this gross negligence in advertising 
security. 

I think there would be more consequences to you going against 
google for it to be worth it. They own so much now and they have so 
much money anything but a class action is just going to get snuffed 
out by their lawyers. Even then that doesn't stop them from banning 
you from google services. 

Jan 28,2018 #9 

Lol.. People will do anything to get a piece of that mining pie. 


Jan 28,2018 #10 

captaincranky said: f 

I'm running an Intel G-41 board with the stock IGP. I'm wondering how much mining 
could this rig accomplish? 


For now, this malicious ads are using the CPU for mining, not the 
graphics card. 
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captaincranky 
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Icysoul said: f 

For now, this malicious ads are using the CPU for mining, not the graphics card. 

Well, with an ancient Pentium Dual Core E-6300 in this "beast", I don't 
think I have too much to worry about in that department either. 

While I was being a bit whimsical about my graphics card's memory 
bandwidth, you bring up a fair point. All I have to do is, listen for the 
CPU fan to speed up, and / or, leave Task manager running 
throughout my online activities to see what's going on. 

Even so, were this machine to be attacked, you couldn't get a nickel's 
worth of Bitcoin out of it, even if I stayed on the site for a month and a 
half. 

But, this issue does pose the question as to whether or not, 

"coinhive", is detectable as a running process? 

Last edited: Jan 28, 2018 
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Its probably gagme that put the cryptominers in the ads in there in the 
first place. 
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